CRII: SaTC: Robust Explainable Provenance-based Intrusion Detection

现代入侵检测系统根据计算机系统的活动历史（也称为数据来源）来检测正在进行的网络攻击。然而，在现实世界中部署它们是具有挑战性的。该项目的新颖之处在于开发下一代入侵检测系统，该系统不仅可以准确识别入侵，还可以精确诊断其根本原因和攻击方法，甚至在攻击者积极试图逃避检测的情况下也是如此。该项目更广泛的意义和重要性在于：(1)为美国政府和大公司日益面临的影响数百万人安全和隐私的现实网络安全威胁提供及时的解决方案；(2)通过组织建立和传播可复制入侵检测实验的研讨会，促进协作性安全社区的建立；(3)培训第一代和LGBTQ学生，以提高来自代表性不足群体的成员在安保队伍中的代表性。该项目解决了危及基于来源的入侵检测系统的有效性和实际采用的三个挑战。首先，他们无法准确解释疾病发作的原因和进展。其次，当攻击者故意试图逃避它们时，它们是无效的。第三，它们需要大量难以获得的来源数据。为了解决这些问题，本项目设计了一种新的入侵检测系统，该系统利用机器学习来突出表明入侵的异常计算机活动。机器学习算法专注于理解攻击，以减少对入侵警报进行分类的人工努力。为了暴露现有入侵检测系统的不足，本课题首先研究了同时攻击主机系统并逃避检测的新型入侵策略。一种引入随机性并增强学习鲁棒性的对抗技术随后被纳入机器学习管道，以减轻此类攻击。最后，利用软件工程和程序分析技术合成良性来源数据来训练入侵检测系统，并将这些技术集成到一个自动化框架中，以促进数据生成。一个成功的项目将推进最先进的端点入侵检测和响应解决方案，改善分析师经验，并增强对政府和其他组织至关重要的网络基础设施的安全性。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Modern intrusion detection systems detect ongoing cyberattacks based on the knowledge of a computer system’s activity history, also known as data provenance. However, deploying them in the real world is challenging. The project’s novelties are the development of a next generation intrusion detection system that not only accurately identifies an intrusion but precisely diagnoses its root cause and method of attack, even in the presence of an attacker who actively tries to evade detection. The project’s broader significance and importance are (1) delivering timely solutions to real-world cybersecurity threats increasingly faced by both the U.S. government and large corporations that affect the security and privacy of millions, (2) fostering a collaborative security community by organizing a workshop on building and disseminating reproducible intrusion detection experiments, and (3) training first-generation and LGBTQ students to improve the representation of members from underrepresented groups in the security workforce.The project addresses three challenges that imperil the efficacy and practical adoption of provenance-based intrusion detection systems. First, they cannot explain precisely the cause and progression of an attack. Second, they are ineffective when an attacker purposefully tries to evade them. Third, they require an abundance of provenance data that is difficult to obtain. To address these problems, this project designs a novel intrusion detection system that leverages machine learning to highlight anomalous computer activity indicating an intrusion. The machine learning algorithm focuses on making sense of the attack to reduce manual effort to triage intrusion alerts. To expose the shortcomings of existing intrusion detection systems, the project first studies new intrusion strategies that simultaneously attack a host computer system and evade detection. A counter measure technique that introduces randomness and strengthens robustness in learning is then incorporated into the machine learning pipeline to mitigate such attacks. Finally, the project leverages software engineering and program analysis techniques to synthesize benign provenance data to train the intrusion detection system and integrates these techniques into an automated framework to facilitate data generation. A successful project will advance state-of-the-art endpoint intrusion detection and response solutions, improve analyst experience, and enhance the security of cyberinfrastructure critical to the government and other organizations.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.